Stuxnet Likely Constituted Illegal Act of Force, Study Says

http://www.securityweek.com/stuxnet-likely-constituted-illegal-act-force-study-says

by techinsidr • 13 years ago

49 23 13 years ago

securityweek.com

anvandare• 13 years ago

Words, words, words...

It's only illegal if you lose the war.

jug6ernaut3• 13 years ago

When did the USA come out and say they made Stuxnet?

JonnieCache• 13 years ago

Last june.

http://www.nytimes.com/2012/06/01/world/middleeast/obama-ord...

jug6ernaut3• 13 years ago

Im looking for more of an official document/announcement. I wasn't able to find anything of the sort in the provided link.

eyuelt• 13 years ago

I was wondering the same thing. It seems to have been a joint project between the governments of the US and Israel. But to my knowledge, neither party has admitted to it, so it would be pretty hard to prove.

lutorm• 13 years ago

If the roles were reversed, it would not even have been up for debate...

jbooth2• 13 years ago

Yeah, but we've known that since Thucydides

tkahn6• 13 years ago

> The argument has been made that Stuxnet was self-defense, but anticipatory self-defense, which makes it a valid use of force. But that is open to debate, because depending on stance made, Stuxnet’s usage could be seen as justifiable defense given Iran’s statements of hostility, or as an act of war against Iran itself.

So... basically Stuxnet is an illegal act of force iff this argument is unsound? Isn't that the case with any use of force?

AnIrishDuck• 13 years ago

Reading the report summary [1], I was especially struck by this line:

> the State itself will be responsible under international law for any actions of individuals or groups who act under its direction. For instance, a State that calls on hacktivists to conduct cyber operations against other States will be responsible for those actions as if it had conducted them itself.

This seems to be an indirect dig at the Comment Crew and other similar groups that many security professionals believe to be indirectly associated with the PLA in China [2].

1. http://www.acus.org/files/tallinn_fact_sheet_20130322.pdf 2. http://arstechnica.com/security/2013/02/unusually-detailed-r...

mpyne• 13 years ago

Comment Crew might be today's example of that, but the general policy of having States be responsible for the actions they direct of contractors has always been in effect in international law, even back to the days of sail when privateers roamed the seas carrying Letters of Marque authorizing them to act for the State.

DanielBMarkham• 13 years ago

You guys know me. I'm the first to run around with their hair on fire when we're talking about illegal or dangerous use of technology by the state.

But there are a couple of things to consider here.

1) " a team of international law practitioners and scholars" -- International Law is an attempt to use treaties and legal customs to resolve disputes among international actors. I won't say that it's a fiction, but states have a tendency to interpret these things in the way that suits them.

2) While I have no doubt that these scholars did a bang-up job inside their own discipline, the field of unconventional internet warfare (which I suppose differs from "regular" internet warfare) is really, really new. The big boys are going to decide how this plays out, not the lawyers

3) Even assuming that the scholars have it right, and that the field is mature enough for their opinions to be useful and/or valid, states do things all the time that are illegal. The problem here is that they got caught.

I have no idea where this is headed. I'm guessing this low-level stuff will morph into large numbers of civilians being killed at some point. Only then will the players decide if and how to ratchet it down a couple of notches.

(I am reminded by this story that WWII was highly illegal. http://en.wikipedia.org/wiki/Kellogg%E2%80%93Briand_Pact)

gadders2• 13 years ago

That is the elephant in the room - that whole "no such thing as international law" concept that people find hard to grasp.

kyllo2• 13 years ago

International law is a thing now, but it won't be respected until there are teeth behind it. And there won't be teeth behind it until there is actually a functioning world government with military and police power. Most currently powerful countries are too self-interested and enjoy their freedom and autonomy too much to actually want such a thing to exist. The UN is an attempt at it, but it is not powerful enough because the powerful member states undermine its authority by vetoing everything that goes against their individual interests. So it gets used as a mere tool for powerful countries to police weak countries' internal and neighborly disputes.

ChuckMcM• 13 years ago

Its a fair point that 'law' isn't what folks necessarily think it is. The role of law changes as we move from municipality to city to county to state to nation and to the world at large. But by and large the law seeks to be an expression of the principles under which we agree to be governed, rules if you will, that codify acceptable and unacceptable behavior or action.

The world is having a conversation with itself. It does so constantly as it seeks to understand what is expected of it. The discussion of computerized warfare or criminal activity is one that has lots of variants. From Aaron Schwartz to DMCA to Stuxnet to peering agreements and spam.

To have that discussion we have to decide on what we can agree on, and what we can't. And when I read this paper I felt starting from the perspective doing a person or property physical harm, was a good step at differentiating between computer acts. We've had an ongoing discussion about economic damage (piracy being the common one), and not a lot about "harmless" hacks.

Having a common understanding about these things are going to be instrumental in writing credible laws about what constitutes a computer crime and what doesn't.

All of that takes thought. And this team has thrown their thoughts out there for consideration. Discussing them is the next step to figure out where we agree and where we disagree.

zeteo• 13 years ago

International law is a very good case study of why the law matters less than the interpretation. Even more so when the law is old and being stretched to deal with completely new phenomena.

grabeh• 13 years ago

Very interesting analysis. The central legal principle that we are talking about here is under the UN Charter which of course all members of the UN agree to abide by.

Article 2(4) provides that all members will refrain from the use of force against the territorial integrity of any state.

I think the question narrowly put is whether the cyber attack is equivalent to a physical attack. In this case, I think you could argue that the Stuxnet worm, at least to my knowledge, had an effect broadly equivalent to a physical attack, say by planes akin to the previous Israeli sortie against Iraq's reactor.

Anticipatory self-defence is a developing topic but I don't think in this case, and borrowing from general self-defence principles, I don't think the threat was imminent enough, particularly in light of Iranian hyperbole.

Of course, the reality of what would actually happen in the case of a breach would still be subject to the desires of individual countries, particularly on the UN Security Council, but for me it is still interesting to assess whether a cyber-attack would constitute a breach of Art 2(4).

Stuxnet Likely Constituted Illegal Act of Force, Study Says

Related Stories